I agree and just want to add IAM to the list of AWS Lock In services. We provisions environments almost entirely using Config-as-code tools (packer, ansible, terraform) and generally have a good blueprint for what an environment looks like and the parts I’ve had the hardest time thinking about migrating to another cloud provider is all the IAM rules that magically give hosts/services the ability to talk to other services.